nerdexam
EC-Council

312-49V11 · Question #118

312-49V11 Question #118: Real Exam Question with Answer & Explanation

The correct answer is B. 4 sectors; it may cause inefficiency in space utilization on the disk. Although 1.5KB equals 1536 bytes (which is 3 sectors at 512 bytes/sector), file systems often allocate storage in clusters/blocks larger than a single sector (e.g., 2KB or 4KB blocks). If the allocation unit is 2KB, the file may occupy 4 sectors (2048 bytes), creating slack space

Question

A computer forensics investigator is analyzing a hard disk drive (HDD) that is suspected to contain evidence of criminal activity. The HDD has 20,000 cylinders, 16 heads, and 63 sectors per track, with each sector having 512 bytes. During the analysis, the investigator discovered a file of 1.5KB in size on the disk. How many sectors are allocated for the file, and what could be the consequences of such allocation for the investigation?

Options

  • A2 sectors; the file might be fragmented, making it harder to retrieve
  • B4 sectors; it may cause inefficiency in space utilization on the disk
  • C3 sectors; it may increase the retrieval time due to increased sector overhead
  • D3 sectors; the file might be fragmented, making it harder to retrieve

Explanation

Although 1.5KB equals 1536 bytes (which is 3 sectors at 512 bytes/sector), file systems often allocate storage in clusters/blocks larger than a single sector (e.g., 2KB or 4KB blocks). If the allocation unit is 2KB, the file may occupy 4 sectors (2048 bytes), creating slack space and inefficient utilization. That slack space can also contain remnants of prior data-relevant for

Community Discussion

No community discussion yet for this question.

Full 312-49V11 Practice
A computer forensics investigator is analyzing a hard disk drive... | 312-49V11 Q#118 Answer | NerdExam